Moderate: python-urllib3 security update
Summary
ALSA-2024:6162: Moderate: python-urllib3 security update. Affects python3-urllib3 versions < 1.26.5-5.el9_4.1. Fixed in 1.26.5-5.el9_4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The python-urllib3 package is a Python HTTP module that provides connection pooling and file POST abilities. It is commonly used for making HTTP requests in Python applications.
Vulnerability Detail
The vulnerability in python-urllib3, identified as CVE-2024-37891, involves the proxy-authorization request header not being stripped during cross-origin redirects. This could potentially lead to unauthorized access or information disclosure when interacting with certain proxies. The impact of this vulnerability is considered moderate.
How To Fix
Minimum fixed version
1.26.5-5.el9_4.1
This is the first release that contains the fix.
sudo dnf update python3-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The python-urllib3 package has a moderate security vulnerability (CVE-2024-37891) related to the handling of proxy-authorization request headers during cross-origin redirects. It is recommended to update the package to version 1.26.5-5.el9_4.1 or later to mitigate the risk of unauthorized access or information disclosure.
See every vulnerability recorded for python3-urllib3 →
FAQ
Python-urllib3 is a Python module that provides HTTP functionality, including connection pooling and file POST abilities.
The vulnerability could potentially lead to unauthorized access or information disclosure when interacting with certain proxies.
To fix this vulnerability, update the python-urllib3 package to version 1.26.5-5.el9_4.1 or later.
No specific workaround has been mentioned for this vulnerability.
You can find more information about this vulnerability in the CVE page(s) listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for python3-urllib3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
